Commercial datasets that contain massive amounts of labeled data samples for malware detection do exist and have been used to train models that deliver excellent malware detection accuracy in the wild [1]}. For instance, the popular Ember dataset contains 1.1 million samples and close to 3,000 distinct malware families. However, obtaining the raw executables in the Ember dataset mandates having a VirusTotal license, which can cost upwards of $400,000 per year!Ember's free offering omits executables, and only presents a limited number of features per binary, e.g., size, library functions. These features are insufficient for most existing data-driven malware detectors, and cannot support long term development: analysts must avoid having adversaries learn about the used features, and cannot test new features without access to the binaries. While there are datasets consisting of raw malware binaries [2]}, they do not contain benign binaries. Thus, practitioners must download only a limited number of binaries to prevent data imbalance which is far from trivial since it is difficult to determine a priori which binaries will allow the model to generalize. Consequently, many cost-constrained practitioners and research groups must resort to far smaller datasets that are publicly available, e.g., the Brazilian malware dataset contains 50K files [3]}, while the Microsoft malware dataset contains 20K files with only 9 malware families [4]}.
